Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

My assumption is they want to eliminate/prevent schemes where a ton of apps are signed as a service by a small number of centrally controlled keys.

Someone elsewhere in the thread said this is how F-Droid works, but I can't confirm firsthand.



The signing certificate should indicate who is signing, and therefore who is liable. But maybe that’s not how they set it up previously.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: